Details remain limited at this stage, and the claims have not been independently confirmed. What stands out is the vector: a zero-day in PeopleSoft, an enterprise application widely used across government and large organizations for HR and personnel management, which makes it an attractive target for data theft.

Key points from the claim:

• ShinyHunters says it exploited a PeopleSoft zero-day to gain access to FBI systems
• The group claims it reached internal services
• Stolen data allegedly includes information on employees and job applicants
• The breach and the zero-day itself have not been verified at the time of reporting

Organizations running PeopleSoft should treat this as a reminder to review exposure of their instances and monitor for unusual access to HR and applicant data. As with any unverified extortion claim, treat the details with caution until confirmed by the affected party or Oracle.

Source: BleepingComputer

If your organization runs PeopleSoft, are you reviewing your exposure in light of this claim?